From AWS docs,
AUTHORIZATION Endpoint
The /oauth2/authorize endpoint signs the user in.
GET /oauth2/authorize
The /oauth2/authorize endpoint only supports HTTPS GET. The user pool client typically makes this request through the system browser, which would typically be Custom Chrome Tab in Android and Safari View Control in iOS.
LOGIN Endpoint
The /login endpoint signs the user in. It loads the login page and presents the authentication options configured for the client to the user.
GET /login
The /login endpoint only supports HTTPS GET. The user pool client makes this request through the system browser, which would typically be Custom Chrome Tabs in Android and Safari View Controller in iOS.
Both endpoints redirect after success, which one to use when?
The difference I noticed is if you have only one identity provider enabled the /authorize route will skip the hosted UI. The identity provider must be a Federation one for this to work. If the identity provider is Cognito you'll still be redirected to the hosted UI to type your password.
Related
I go to my application and check if there is JWT cookie
If it is there, I parse it and start to verify if user have access to my application
If it is not there, I will redirect user to authenticate in FusionAuth
After successful login, user will be redirected back to my application
How do I specify in step 3 fusionauth id of my application?
And how do I specify that I want to redirect to my application after successful login?
I assume that fusionauth is running on fusionauth.mydomain.com and application on myapp.mydomain.com and JWT cookie will be issued in mydomain.com, so it will be visible for both.
Yes, this is possible.
In step 3, you will redirect the browser to the FusionAuth login page. Navigate to Settings --> Applications in the FusionAuth UI and click on the green view button for the application in questio.
This will bring up a dialog which will show integration information (if you're on a recent version of FusionAuth).
You'll see a link something like this:
OAuth IdP login URL: https://fusionauth.mydomain.com/oauth2/authorize?client_id=ee31103f-2fc1-4bb5-ba95-ac543693503e&response_type=code&redirect_uri={your URI here}
The client_id parameter in this case will identify your application to FusionAuth.
And how do I specify that I want to redirect to my application after successful login?
This is configured in FusionAuth as an authorized redirect, and then you specify this same URL when redirecting to FusionAuth to login. Notice the redirect_uri parameter in the example URL above. There is a screenshot of this configuration here: https://fusionauth.io/docs/v1/tech/oauth/overview
I assume that fusionauth is running on fusionauth.mydomain.com and application on myapp.mydomain.com and JWT cookie will be issued in mydomain.com, so it will be visible for both.
FusionAuth does not currently drop cross domain cookies. If you are running FusionAuth at fusionauth.mydomain.com the Cookie will have that same domain and not be visible to myapp.mydomain.com.
If you want to leverage FusionAuth, then you do not need to inspect the cookie on myapp.mydomain.com, you'll simply redirect the user if they are not logged in and then if the user already has a SSO session on FusionAuth, they will be seamlessly redirected back to your application.
You can review our login workflows to identify the one that fits your requirements the best and then follow the recommended workflow. https://fusionauth.io/articles/logins/types-of-logins-authentication-workflows
This appears to be a standard OAuth Authorization Code Grant workflow. We have this workflow and many others documented here:
https://fusionauth.io/articles/logins/types-of-logins-authentication-workflows
My guess is that your specific workflow is likely the Authorization Code Grant for Single-Page Applications using JWTs and Refresh Tokens that is documented here:
https://fusionauth.io/articles/logins/spa/oauth-authorization-code-grant-jwts-refresh-tokens-cookies
The way that this works is that you start the OAuth workflow from your application by redirecting the browser to FusionAuth's /oauth2/authorize endpoint. You will need to supply this information to start the OAuth workflow:
client_id - this can be found under the Application configuration in FusionAuth
response_type - for the Authorization Code grant, this will be code
redirect_uri - this is the location you want the user to return to after they log in with FusionAuth. You must configure this URI in FusionAuth under the Application's OAuth configuration tab.
If you are running FusionAuth 1.6.0 or newer, you can also click the "View" icon for your Application and it will display a pop-up dialog that will contain the OAuth URL. You will still need to specify the redirect_uri though. Here is the documentation page for the Authorize endpoint:
https://fusionauth.io/docs/v1/tech/oauth/endpoints#authorize
Once you have that working, you will need to write the Controller for your redirect_uri. This Controller will take the code from the URL that FusionAuth generates and call the /oauth2/token endpoint. This process will exchange the authorization code for an access token, which is a JWT.
The documentation for the /oauth2/otken endpoint is located there:
https://fusionauth.io/docs/v1/tech/oauth/endpoints#token
This will help you implement your Controller.
We're having a native iOS and Android app that has a custom login form to authenticate a user directly via an authentication endpoint of an oAuth2 enabled indentity provider (the app sends the user credentials via HTTP request to the identity provider and gets a JWT as response).
The app does not have the possibility to open a browser with callback url or an in-app-browser to open the login form of the identity provider directly - so there is no possibility to set a cookie for SSO.
The app does sometimes redirect the user to other services (in the web browser) that are using the same identitiy provider. Until now, the user is forced to enter his credentials again to signin.
We're now looking for a (secure) way to implement SSO with the app, without the need of using a cookie enabled (in-app-)browser for the app login.
A solution we thought about:
sending a valid access_token to the identity provider together with the target url of the service
the identity provider validates the token and the target url
the identity provider authenticates the user after successfull validation and redirects the user to the service
Can this be considered as a secure solution? Is there a standardized way we don't know about to do something like that?
Is it possible that AWS Cognito redirects user to a http endpoint with user's access token if the user is authenticate user with Cognito? I need to implement this authorization flow in react web application. Basic idea is that user gives his credentials such as user's email address and password, then Cognito takes them to check if he is authenticate user or not. If he is, it should redirect user by passing the token to callback URL (in my case this is an http endpoint). After then the URL gets the token, it gives him access as final step.
This is possible. But you need to make sure your HTTP endpoint is able to redirect back to an UI page (Or React route) or render HTML after accessing the token retrieved in parameters.
Note: Simply having a HTTP backend URL won't work since the authentication flow requires to redirect the user to the application.
Created a web based application which needs to integrate forms authentication and SSO. Currently forms authentication will validate all the registered users.
What I need is to integrate SSO as well in to the application. ie, If the user not authenticated then redirect to identity server (Okta) configured with WS-Fed and added the application, validate and response to landing page. Please can you help on this. Please let me know if any more information is required.
Can you please explain this statement " If the user not authenticated then redirect to identity server (Okta) configured with WS-Fed and added the application"?
Please see this link https://github.com/okta/okta-music-store. Under section "Adding Single-sign on to your Music Store" you can see how C# sdk can be used to implement single sign on.
Essentially what you need is a cookieToken from Okta. Using cookieToken as one time token and a redirect url (Can be your app url) you can use /login/sessionCookieRedirect?token=&redirectUrl=. This will create active session with Okta and redirect your user to your app or redirect uri.
Cookie token is obtained via series of two calls. Authentication that gives you session token in response. Session token is exchanged for cookie token via create session call.
Basically I just want to know how does StackExchange's single signon system work?
In the SE network you need to login only once in one of the websites to be automatically logged in to the other sites upon visiting.
How should I implement such a feature in my own network of sites?
I assume it uses the cookie which resides on the user's browser and then authenticates it with the originating site. If it is legit then it logs the user in automatically.
You have to implement SAML or oauth2 to allow sso on your network.
In case of SAML your child websites will be service providers or resource servers.
While you need to setup and identity provider.
The sequence of events will be like this.
1. User hits a url of songs website, this site is resource server and does not handle authentication.
2.To authenticate resource server will construct a SAML authrequest and redirects to identity provider after signing it.
Idp verifies the signature after receiving authrequest.
3. User will be presented with a login form, user has to end login credentials.
4. After user authentication idp will generate a SAMl token and redirect back to resource server.
5. Resource server will extract identity information from SAML token, resource server will login the user with session or cookie.
Depends upon which technology you are working in i have implemented it in php using simplesamlphp.